@auth-gate/core 0.2.0 → 0.5.0

package/README.md

@@ -15,9 +15,7 @@ import { createAuthGateClient } from "@auth-gate/core";
 
 const client = createAuthGateClient({
   apiKey: process.env.AUTHGATE_API_KEY!,
-  projectId: process.env.AUTHGATE_PROJECT_ID!,
   baseUrl: "https://authgate.dev", // or your self-hosted instance
-  sessionSecret: process.env.SESSION_SECRET!, // min 32 characters
 });
 ```
 
@@ -28,8 +26,8 @@ const client = createAuthGateClient({
 Supports Google, GitHub, Discord, Azure (Microsoft), and Apple.
 
 ```ts
-// Generate the authorization URL
-const url = client.getOAuthUrl("google", "https://yourapp.com/auth/callback");
+// Generate the authorization URL (async — resolves project ID from API key)
+const url = await client.getOAuthUrl("google", "https://yourapp.com/auth/callback");
 
 // After callback, verify the JWT token from AuthGate
 const result = await client.verifyToken(token);
@@ -145,10 +143,8 @@ client.getNonceCookieOptions();
 
 | Option | Type | Required | Description |
 |--------|------|----------|-------------|
-| `apiKey` | `string` | Yes | Your AuthGate API key |
-| `projectId` | `string` | Yes | Your AuthGate project ID |
+| `apiKey` | `string` | Yes | Your AuthGate API key (also used to resolve project ID) |
 | `baseUrl` | `string` | Yes | AuthGate instance URL |
-| `sessionSecret` | `string` | Yes | Encryption secret (min 32 chars) |
 | `cookieName` | `string` | No | Session cookie name (default: `__authgate`) |
 | `sessionMaxAge` | `number` | No | Session TTL in seconds (default: `604800` / 7 days) |
 | `callbackPath` | `string` | No | OAuth callback path (default: `/api/auth/callback`) |

package/dist/index.cjs

@@ -301,17 +301,11 @@ var InvalidStateError = class extends AuthGateError {
 var AuthGateClient = class {
   /**
    * @param config - Client configuration. See {@link AuthGateConfig}.
-   * @throws {@link AuthGateError} if `sessionSecret` is shorter than 32 characters.
    */
   constructor(config) {
     this.encryptionKey = null;
     this.stateKey = null;
     var _a, _b, _c;
-    if (!config.sessionSecret || config.sessionSecret.length < 32) {
-      throw new AuthGateError(
-        "sessionSecret must be at least 32 characters long"
-      );
-    }
     this.config = __spreadProps(__spreadValues({}, config), {
       cookieName: (_a = config.cookieName) != null ? _a : DEFAULT_COOKIE_NAME,
       sessionMaxAge: (_b = config.sessionMaxAge) != null ? _b : SESSION_MAX_AGE,
@@ -321,8 +315,8 @@ var AuthGateClient = class {
   }
   async deriveKeys() {
     const [encKey, stKey] = await Promise.all([
-      deriveEncryptionKey(this.config.sessionSecret),
-      deriveStateKey(this.config.sessionSecret)
+      deriveEncryptionKey(this.config.apiKey),
+      deriveStateKey(this.config.apiKey)
     ]);
     this.encryptionKey = encKey;
     this.stateKey = stKey;
@@ -459,17 +453,28 @@ var AuthGateClient = class {
    * @returns The full authorization URL to redirect the user to.
    * @throws {@link AuthGateError} if the provider is not in {@link SUPPORTED_PROVIDERS}.
    */
-  getOAuthUrl(provider, callbackUrl, options) {
+  async getOAuthUrl(provider, callbackUrl, options) {
     if (!SUPPORTED_PROVIDERS.includes(provider)) {
       throw new AuthGateError(`Unsupported provider: ${provider}`);
     }
-    const url = new URL(`/api/proxy/${provider}`, this.config.baseUrl);
-    url.searchParams.set("project_id", this.config.projectId);
-    url.searchParams.set("callback_url", callbackUrl);
-    if (options == null ? void 0 : options.linkTo) {
-      url.searchParams.set("link_to", options.linkTo);
+    const response = await fetch(`${this.config.baseUrl}/api/proxy/${provider}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        callback_url: callbackUrl,
+        state: options == null ? void 0 : options.state,
+        link_to: options == null ? void 0 : options.linkTo
+      })
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({}));
+      throw new AuthGateError(error.error || `OAuth initiation failed: ${response.status}`);
     }
-    return url.toString();
+    const data = await response.json();
+    return data.redirect_url;
   }
   // ---------------------------------------------------------------------------
   // Email auth
@@ -483,12 +488,14 @@ var AuthGateClient = class {
   async emailSignup(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/signup`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
         password: data.password,
         name: data.name,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -505,11 +512,13 @@ var AuthGateClient = class {
   async emailSignin(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/signin`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
         password: data.password,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -523,10 +532,12 @@ var AuthGateClient = class {
   async emailForgotPassword(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/reset-password`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -542,11 +553,13 @@ var AuthGateClient = class {
       `${this.config.baseUrl}/api/proxy/email/reset-password/confirm`,
       {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
         body: JSON.stringify({
           token: data.token,
-          password: data.password,
-          project_id: this.config.projectId
+          password: data.password
         })
       }
     );
@@ -565,10 +578,12 @@ var AuthGateClient = class {
       `${this.config.baseUrl}/api/proxy/email/magic-link/send`,
       {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
         body: JSON.stringify({
           email: data.email,
-          project_id: this.config.projectId,
           callback_url: data.callbackUrl
         })
       }
@@ -586,11 +601,13 @@ var AuthGateClient = class {
   async emailVerifyCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/verify`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
-        code: data.code,
-        project_id: this.config.projectId
+        code: data.code
       })
     });
   }
@@ -606,10 +623,12 @@ var AuthGateClient = class {
   async smsSendCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/sms/send-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         phone: data.phone,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -623,11 +642,13 @@ var AuthGateClient = class {
   async smsVerifyCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/sms/verify-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         phone: data.phone,
         code: data.code,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -650,10 +671,12 @@ var AuthGateClient = class {
         `${this.config.baseUrl}/api/proxy/token/refresh`,
         {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
           body: JSON.stringify({
-            refresh_token: refreshToken,
-            project_id: this.config.projectId
+            refresh_token: refreshToken
           })
         }
       );
@@ -678,10 +701,12 @@ var AuthGateClient = class {
         `${this.config.baseUrl}/api/proxy/sessions/revoke`,
         {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
           body: JSON.stringify({
-            refresh_token: refreshToken,
-            project_id: this.config.projectId
+            refresh_token: refreshToken
           })
         }
       );
@@ -704,10 +729,11 @@ var AuthGateClient = class {
   async mfaVerify(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/mfa/verify`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(__spreadProps(__spreadValues({}, data), {
-        project_id: this.config.projectId
-      }))
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(data)
     });
   }
   /**
@@ -838,11 +864,11 @@ var AuthGateClient = class {
   async mfaSmsSendCode(challenge) {
     return fetch(`${this.config.baseUrl}/api/proxy/mfa/sms/send-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        challenge,
-        project_id: this.config.projectId
-      })
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ challenge })
     });
   }
   // ---------------------------------------------------------------------------
@@ -864,10 +890,6 @@ var AuthGateClient = class {
   get callbackPath() {
     return this.config.callbackPath;
   }
-  /** The AuthGate project ID. */
-  get projectId() {
-    return this.config.projectId;
-  }
   /** The AuthGate service base URL. */
   get baseUrl() {
     return this.config.baseUrl;

package/dist/index.d.cts

@@ -47,24 +47,15 @@ interface TokenVerifyResult {
  *
  * const client = createAuthGateClient({
  *   apiKey: process.env.AUTHGATE_API_KEY!,
- *   projectId: process.env.AUTHGATE_PROJECT_ID!,
  *   baseUrl: "https://authgate.dev",
- *   sessionSecret: process.env.SESSION_SECRET!, // min 32 chars
  * });
  * ```
  */
 interface AuthGateConfig {
-    /** Server-side API key for your AuthGate project. Found in the dashboard under API Keys. */
+    /** Server-side API key for your AuthGate project. Found in the dashboard under API Key. */
     apiKey: string;
-    /** The project ID from your AuthGate dashboard. */
-    projectId: string;
     /** Base URL of the AuthGate service (e.g. `"https://authgate.dev"`). */
     baseUrl: string;
-    /**
-     * Secret used to derive encryption keys for session cookies and OAuth state.
-     * Must be at least 32 characters. Use a cryptographically random string.
-     */
-    sessionSecret: string;
     /**
      * Name of the session cookie.
      * @defaultValue `"__authgate"`
@@ -178,9 +169,7 @@ interface BackupCodesResponse {
  * ```ts
  * const client = new AuthGateClient({
  *   apiKey: process.env.AUTHGATE_API_KEY!,
- *   projectId: process.env.AUTHGATE_PROJECT_ID!,
  *   baseUrl: "https://authgate.dev",
- *   sessionSecret: process.env.SESSION_SECRET!,
  * });
  * ```
  */
@@ -191,7 +180,6 @@ declare class AuthGateClient {
     private keysReady;
     /**
      * @param config - Client configuration. See {@link AuthGateConfig}.
-     * @throws {@link AuthGateError} if `sessionSecret` is shorter than 32 characters.
      */
     constructor(config: AuthGateConfig);
     private deriveKeys;
@@ -270,8 +258,9 @@ declare class AuthGateClient {
      * @throws {@link AuthGateError} if the provider is not in {@link SUPPORTED_PROVIDERS}.
      */
     getOAuthUrl(provider: OAuthProvider, callbackUrl: string, options?: {
+        state?: string;
         linkTo?: string;
-    }): string;
+    }): Promise<string>;
     /**
      * Register a new user with email and password.
      *
@@ -467,8 +456,6 @@ declare class AuthGateClient {
     get refreshTokenCookieName(): string;
     /** The callback path where OAuth redirects are handled (default: `"/api/auth/callback"`). */
     get callbackPath(): string;
-    /** The AuthGate project ID. */
-    get projectId(): string;
     /** The AuthGate service base URL. */
     get baseUrl(): string;
     /** Session lifetime in seconds. */

package/dist/index.d.ts

@@ -47,24 +47,15 @@ interface TokenVerifyResult {
  *
  * const client = createAuthGateClient({
  *   apiKey: process.env.AUTHGATE_API_KEY!,
- *   projectId: process.env.AUTHGATE_PROJECT_ID!,
  *   baseUrl: "https://authgate.dev",
- *   sessionSecret: process.env.SESSION_SECRET!, // min 32 chars
  * });
  * ```
  */
 interface AuthGateConfig {
-    /** Server-side API key for your AuthGate project. Found in the dashboard under API Keys. */
+    /** Server-side API key for your AuthGate project. Found in the dashboard under API Key. */
     apiKey: string;
-    /** The project ID from your AuthGate dashboard. */
-    projectId: string;
     /** Base URL of the AuthGate service (e.g. `"https://authgate.dev"`). */
     baseUrl: string;
-    /**
-     * Secret used to derive encryption keys for session cookies and OAuth state.
-     * Must be at least 32 characters. Use a cryptographically random string.
-     */
-    sessionSecret: string;
     /**
      * Name of the session cookie.
      * @defaultValue `"__authgate"`
@@ -178,9 +169,7 @@ interface BackupCodesResponse {
  * ```ts
  * const client = new AuthGateClient({
  *   apiKey: process.env.AUTHGATE_API_KEY!,
- *   projectId: process.env.AUTHGATE_PROJECT_ID!,
  *   baseUrl: "https://authgate.dev",
- *   sessionSecret: process.env.SESSION_SECRET!,
  * });
  * ```
  */
@@ -191,7 +180,6 @@ declare class AuthGateClient {
     private keysReady;
     /**
      * @param config - Client configuration. See {@link AuthGateConfig}.
-     * @throws {@link AuthGateError} if `sessionSecret` is shorter than 32 characters.
      */
     constructor(config: AuthGateConfig);
     private deriveKeys;
@@ -270,8 +258,9 @@ declare class AuthGateClient {
      * @throws {@link AuthGateError} if the provider is not in {@link SUPPORTED_PROVIDERS}.
      */
     getOAuthUrl(provider: OAuthProvider, callbackUrl: string, options?: {
+        state?: string;
         linkTo?: string;
-    }): string;
+    }): Promise<string>;
     /**
      * Register a new user with email and password.
      *
@@ -467,8 +456,6 @@ declare class AuthGateClient {
     get refreshTokenCookieName(): string;
     /** The callback path where OAuth redirects are handled (default: `"/api/auth/callback"`). */
     get callbackPath(): string;
-    /** The AuthGate project ID. */
-    get projectId(): string;
     /** The AuthGate service base URL. */
     get baseUrl(): string;
     /** Session lifetime in seconds. */

package/dist/index.mjs

@@ -267,17 +267,11 @@ var InvalidStateError = class extends AuthGateError {
 var AuthGateClient = class {
   /**
    * @param config - Client configuration. See {@link AuthGateConfig}.
-   * @throws {@link AuthGateError} if `sessionSecret` is shorter than 32 characters.
    */
   constructor(config) {
     this.encryptionKey = null;
     this.stateKey = null;
     var _a, _b, _c;
-    if (!config.sessionSecret || config.sessionSecret.length < 32) {
-      throw new AuthGateError(
-        "sessionSecret must be at least 32 characters long"
-      );
-    }
     this.config = __spreadProps(__spreadValues({}, config), {
       cookieName: (_a = config.cookieName) != null ? _a : DEFAULT_COOKIE_NAME,
       sessionMaxAge: (_b = config.sessionMaxAge) != null ? _b : SESSION_MAX_AGE,
@@ -287,8 +281,8 @@ var AuthGateClient = class {
   }
   async deriveKeys() {
     const [encKey, stKey] = await Promise.all([
-      deriveEncryptionKey(this.config.sessionSecret),
-      deriveStateKey(this.config.sessionSecret)
+      deriveEncryptionKey(this.config.apiKey),
+      deriveStateKey(this.config.apiKey)
     ]);
     this.encryptionKey = encKey;
     this.stateKey = stKey;
@@ -425,17 +419,28 @@ var AuthGateClient = class {
    * @returns The full authorization URL to redirect the user to.
    * @throws {@link AuthGateError} if the provider is not in {@link SUPPORTED_PROVIDERS}.
    */
-  getOAuthUrl(provider, callbackUrl, options) {
+  async getOAuthUrl(provider, callbackUrl, options) {
     if (!SUPPORTED_PROVIDERS.includes(provider)) {
       throw new AuthGateError(`Unsupported provider: ${provider}`);
     }
-    const url = new URL(`/api/proxy/${provider}`, this.config.baseUrl);
-    url.searchParams.set("project_id", this.config.projectId);
-    url.searchParams.set("callback_url", callbackUrl);
-    if (options == null ? void 0 : options.linkTo) {
-      url.searchParams.set("link_to", options.linkTo);
+    const response = await fetch(`${this.config.baseUrl}/api/proxy/${provider}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        callback_url: callbackUrl,
+        state: options == null ? void 0 : options.state,
+        link_to: options == null ? void 0 : options.linkTo
+      })
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({}));
+      throw new AuthGateError(error.error || `OAuth initiation failed: ${response.status}`);
     }
-    return url.toString();
+    const data = await response.json();
+    return data.redirect_url;
   }
   // ---------------------------------------------------------------------------
   // Email auth
@@ -449,12 +454,14 @@ var AuthGateClient = class {
   async emailSignup(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/signup`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
         password: data.password,
         name: data.name,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -471,11 +478,13 @@ var AuthGateClient = class {
   async emailSignin(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/signin`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
         password: data.password,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -489,10 +498,12 @@ var AuthGateClient = class {
   async emailForgotPassword(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/reset-password`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -508,11 +519,13 @@ var AuthGateClient = class {
       `${this.config.baseUrl}/api/proxy/email/reset-password/confirm`,
       {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
         body: JSON.stringify({
           token: data.token,
-          password: data.password,
-          project_id: this.config.projectId
+          password: data.password
         })
       }
     );
@@ -531,10 +544,12 @@ var AuthGateClient = class {
       `${this.config.baseUrl}/api/proxy/email/magic-link/send`,
       {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
         body: JSON.stringify({
           email: data.email,
-          project_id: this.config.projectId,
           callback_url: data.callbackUrl
         })
       }
@@ -552,11 +567,13 @@ var AuthGateClient = class {
   async emailVerifyCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/verify`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
-        code: data.code,
-        project_id: this.config.projectId
+        code: data.code
       })
     });
   }
@@ -572,10 +589,12 @@ var AuthGateClient = class {
   async smsSendCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/sms/send-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         phone: data.phone,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -589,11 +608,13 @@ var AuthGateClient = class {
   async smsVerifyCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/sms/verify-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         phone: data.phone,
         code: data.code,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -616,10 +637,12 @@ var AuthGateClient = class {
         `${this.config.baseUrl}/api/proxy/token/refresh`,
         {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
           body: JSON.stringify({
-            refresh_token: refreshToken,
-            project_id: this.config.projectId
+            refresh_token: refreshToken
           })
         }
       );
@@ -644,10 +667,12 @@ var AuthGateClient = class {
         `${this.config.baseUrl}/api/proxy/sessions/revoke`,
         {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
           body: JSON.stringify({
-            refresh_token: refreshToken,
-            project_id: this.config.projectId
+            refresh_token: refreshToken
           })
         }
       );
@@ -670,10 +695,11 @@ var AuthGateClient = class {
   async mfaVerify(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/mfa/verify`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(__spreadProps(__spreadValues({}, data), {
-        project_id: this.config.projectId
-      }))
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(data)
     });
   }
   /**
@@ -804,11 +830,11 @@ var AuthGateClient = class {
   async mfaSmsSendCode(challenge) {
     return fetch(`${this.config.baseUrl}/api/proxy/mfa/sms/send-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        challenge,
-        project_id: this.config.projectId
-      })
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ challenge })
     });
   }
   // ---------------------------------------------------------------------------
@@ -830,10 +856,6 @@ var AuthGateClient = class {
   get callbackPath() {
     return this.config.callbackPath;
   }
-  /** The AuthGate project ID. */
-  get projectId() {
-    return this.config.projectId;
-  }
   /** The AuthGate service base URL. */
   get baseUrl() {
     return this.config.baseUrl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-gate/core",
-  "version": "0.2.0",
+  "version": "0.5.0",
   "type": "module",
   "exports": {
     ".": {